Re: [logs] perl question relating to log analysis

From: Sweth Chandramouli (loganalysisat_private)
Date: Wed Aug 28 2002 - 19:53:56 PDT

  • Next message: Sweth Chandramouli: "Re: [logs] perl question relating to log analysis"

    On Tue, Aug 27, 2002 at 04:56:50PM +0000, Jeff Schaller wrote:
    > if (/seven/)
    > 
    > can fail more quickly against "eight" than can:
    > 
    > if (/^....$/)
    > 
    > as it can fail on the initial "s" vs "e" as opposed to the
    > character count difference at the end.
    	The general concept of "literal strings match/fail faster
    than patterns" is generally true (for NFA regex engines, at least--DFAs
    are an entirely different beast), but this particular example doesn't
    work as described, because the second regex is anchored.  Without
    anchors, the first regex will fail on the "s == e" comparison, but it
    will then advance, and compare "s" against "i", "s" against "g", "s"
    against "h", and "s" against "t", before failing for good; those five
    failures would probably take longer than the single failure after four
    chars that the second regex would reuire.  (Note that you should
    _always_ benchmark things like this with your own particular regex
    engine; many engines will incoporate optimizations like counting the
    number of chars in the target string, in which case they _will_ fail
    after the "s == e" test, since they know that there's no point in
    advancing and retrying.)
    
    	-- Sweth, who was supposed to deliver a chapter about this
    very topic to his editor a few weeks ago, but seems to have fallen
    behind.
    
    -- 
    Sweth Chandramouli      Idiopathic Systems Consulting
    svcat_private      http://www.idiopathic.net/
    _______________________________________________
    LogAnalysis mailing list
    LogAnalysisat_private
    http://lists.shmoo.com/mailman/listinfo/loganalysis
    



    This archive was generated by hypermail 2b30 : Wed Aug 28 2002 - 21:26:47 PDT